How can we restrict access to the monitoring page of Java Melody?

[SimoneK]

Hello all,

we installed Java Melody for JIRA 6.1.6 and we are really happy about the monitoring it supplies. The problem is, that everyone has access to the monitoring page even if they are not logged in. I could not find a hint how to restrict the access to the pages when Java Melody is used as a plugin for JIRA. So any help from you would be very much appreciated.

Thanks a lot,
Simone

[Henning Tietgens]

Hi,

I have the same problem. We're using Apache2 as a reverse proxy (https) which redirects using ajp protocol to JIRA (standalone). Installation was copying the JavaMelody plugin jar to <tt>atlassian-jira/WEB-INF/lib as described here.</tt>

I added the following to the apache sites file

<Files monitoring>
        Satisfy any
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1

        AuthType Basic
        AuthName "Authorization Required"
        AuthUserFile /etc/apache2/.htpasswd
        Require valid-user
    </Files>

and restarted apache, but it didn't work.

Any suggestions how to restrict access to /monitoring?

Thanks

Henning

[Bernhard Gruenewaldt]

did you install it as a war-file inside the tomcat of a jira installation using the installer?

Which kind of setup did you use for Jira? How did you install Java Melody?

Are you using an apache webser with mod_proxy in front of jira?

If you give me more details I can surely help you.

[Bernhard Grünewaldt]

did you install it as a war-file inside the tomcat of a jira installation using the installer?

Which kind of setup did you use for Jira? How did you install Java Melody?

Are you using an apache webser with mod_proxy in front of jira?

If you give me more details I can surely help you.